Nixpkgs Security Tracker

Login with GitHub

Automatically generated suggestions

to slate a suggestion for refinement.

to mark a suggestion as irrelevant and log the reason.

View:
Compact
Detailed
Permalink CVE-2024-11858
8.6 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): LOCAL
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): HIGH
  • Availability impact (A): HIGH
created 6 months ago
Radare2: command injection via pebble application files in radare2

A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. Maliciously crafted inputs can inject shell commands during command parsing, leading to unintended behavior during file processing​

References

Affected products

radare2
  • <5.9.9

Matching in nixpkgs

pkgs.radare2

UNIX-like reverse engineering framework and command-line toolset

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-27456
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
WordPress Total theme <= 2.1.19 - Authenticated Arbitrary Plugin Activation

Missing Authorization vulnerability in HashThemes Total allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Total: from n/a through 2.1.19.

References

Affected products

total
  • =<2.1.19

Matching in nixpkgs

pkgs.autotalent

Real-time pitch correction LADSPA plugin (no MIDI control)

  • nixos-unstable -

pkgs.gnomeExtensions.net-totals-simplified

A Net totals extension that only displays totals. Forked from Net Speed extension (netspeedsimplified@prateekmedia.extension) With Loads of Customization, version 43

  • nixos-unstable -
    • nixpkgs-unstable 3

Package maintainers

Permalink CVE-2024-54245
6.5 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months ago
WordPress Clients plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Think201 Clients allows Stored XSS.This issue affects Clients: from n/a through 1.1.4.

References

Affected products

clients
  • =<1.1.4

Matching in nixpkgs

pkgs.xlsclients

Utility to list client applications running on a X11 display

  • nixos-unstable -

pkgs.xorg.xlsclients

Utility to list client applications running on a X11 display

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-38383
5.4 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months ago
WordPress Language plugin <= 1.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in OnTheGoSystems Language allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Language: from n/a through 1.2.1.

References

Affected products

wordpress-language
  • =<1.2.1

Matching in nixpkgs

Permalink CVE-2024-54322
7.1 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): REQUIRED
  • Scope (S): CHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months ago
WordPress Media Downloader plugin <= 0.4.7.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ederson Peka Media Downloader allows Reflected XSS.This issue affects Media Downloader: from n/a through 0.4.7.4.

References

Affected products

media-downloader
  • =<0.4.7.4

Matching in nixpkgs

Package maintainers

Permalink CVE-2024-8698
7.7 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): HIGH
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): CHANGED
  • Confidentiality impact (C): HIGH
  • Integrity impact (I): LOW
  • Availability impact (A): LOW
created 6 months ago
Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.

References

Affected products

keycloak
  • <25.0.5
eap8-hppc
  • *
eap8-log4j
  • *
eap8-slf4j
  • *
eap8-jctools
  • *
eap8-jgroups
  • *
eap8-wildfly
  • *
eap8-narayana
  • *
eap8-asyncutil
  • *
eap8-hibernate
  • *
eap8-saaj-impl
  • *
eap8-snakeyaml
  • *
eap8-apache-cxf
  • *
eap8-cryptacular
  • *
eap8-fastinfoset
  • *
rh-sso7-keycloak
  • *
eap8-aws-java-sdk
  • *
eap8-pem-keystore
  • *
eap8-aesh-readline
  • *
eap8-jboss-logging
  • *
eap8-objectweb-asm
  • *
eap8-artemis-native
  • *
rhbk/keycloak-rhel9
  • *
eap8-aesh-extensions
  • *
eap8-nimbus-jose-jwt
  • *
eap8-resteasy-spring
  • *
eap8-activemq-artemis
  • *
eap8-apache-commons-io
  • *
eap8-jboss-cert-helper
  • *
eap8-apache-commons-lang
  • *
eap8-hibernate-validator
  • *
eap8-resteasy-extensions
  • *
Red Hat Build of Keycloak
eap8-apache-commons-codec
  • *
eap8-insights-java-client
  • *
keycloak-saml-core-public
eap8-activemq-artemis-native
  • *
eap8-eap-product-conf-parent
  • *
eap8-shibboleth-java-support
  • *
org.keycloak-keycloak-parent
rhbk/keycloak-rhel9-operator
  • *
rhbk/keycloak-operator-bundle
  • *
rh-sso-7/sso76-openshift-rhel8
  • *
eap8-apache-commons-collections
  • *
org.keycloak/keycloak-saml-core
eap8-artemis-wildfly-integration
  • *
eap8-jakarta-servlet-jsp-jstl-api
  • *
org.keycloak/keycloak-saml-core-public

Matching in nixpkgs

pkgs.keycloak

Identity and access management for modern applications and services

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-49845
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
WordPress Redirects plugin <= 1.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Loud Dog Redirects allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Redirects: from n/a through 1.2.1.

References

Affected products

redirects
  • =<1.2.1

Matching in nixpkgs

Package maintainers

Permalink CVE-2023-30486
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
WordPress Square theme <= 2.0.0 - Broken Access Control

Missing Authorization vulnerability in HashThemes Square allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Square: from n/a through 2.0.0.

References

Affected products

square
  • =<2.0.0

Matching in nixpkgs

pkgs.kreative-square

Fullwidth scalable monospace font designed specifically to support pseudographics, semigraphics, and private use characters

pkgs.kdePackages.ksquares

KSquares is modeled after the well known pen and paper based game of Dots and Boxes

Package maintainers

Permalink CVE-2023-25993
4.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): NONE
  • Integrity impact (I): LOW
  • Availability impact (A): NONE
created 6 months ago
WordPress Top 10 – Popular posts plugin for WordPress plugin <= 3.2.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in WebberZone Top 10 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Top 10: from n/a through 3.2.3.

References

Affected products

top-10
  • =<3.2.3

Matching in nixpkgs

pkgs.budgie-desktop

Feature-rich, modern desktop designed to keep out the way of the user

  • nixos-unstable -

Package maintainers

Permalink CVE-2023-50882
5.3 MEDIUM
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): NONE
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): NONE
  • Availability impact (A): NONE
created 6 months ago
WordPress ProfilePress plugin <= 4.13.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in ProfilePress Membership Team ProfilePress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfilePress: from n/a through 4.13.2.

References

Affected products

profilepress
  • =<4.13.2
wp-user-avatar
  • =<4.13.2

Matching in nixpkgs